The six lawful bases

Every instance of processing personal data needs at least one lawful basis under Article 6. There are six:

• Consent: the individual has given clear, freely given, specific, informed and unambiguous agreement.
• Contract: processing is necessary to perform a contract with the individual, or to take steps at their request before entering one.
• Legal obligation: processing is necessary to comply with the law (not a contractual obligation).
• Vital interests: processing is necessary to protect someone's life, typically used in emergencies.
• Public task: processing is necessary to perform a task in the public interest, or for official functions with a clear basis in law.
• Legitimate interests: processing is necessary for a legitimate interest of the organisation or a third party, unless outweighed by the individual's rights and interests.

No single basis is "better" than the others, and you should pick the one that most accurately reflects the true nature of your relationship with the individual, not the one that's easiest to obtain.